cpe:2.3:a:tribe29:checkmk:2.1.0:b6:*:*:*:*:*:*
Least privilege violation and reliance on untrusted inputs in the mk_informix Checkmk agent plugin before Checkmk 2.3.0b4 (beta), 2.2.0p24, 2.1.0p41 and 2.0.0 (EOL) allows local users to escalate privileges.
Max CVSS
8.8
EPSS Score
0.04%
Published
2024-03-22
Updated
2024-03-22
Invocation of the sqlplus command with sensitive information in the command line in the mk_oracle Checkmk agent plugin before Checkmk 2.3.0b4 (beta), 2.2.0p24, 2.1.0p41 and 2.0.0 (EOL) allows the extraction of this information from the process list.
Max CVSS
3.8
EPSS Score
0.04%
Published
2024-03-22
Updated
2024-03-22
Least privilege violation in the Checkmk agent plugins mk_oracle, mk_oracle.ps1, and mk_oracle_crs before Checkmk 2.3.0b4 (beta), 2.2.0p24, 2.1.0p41 and 2.0.0 (EOL) allows local users to escalate privileges.
Max CVSS
8.2
EPSS Score
0.04%
Published
2024-03-22
Updated
2024-03-22
Insufficient authentication flow in Checkmk before 2.2.0p18, 2.1.0p38 and 2.0.0p39 allows attacker to use locked credentials
Max CVSS
8.8
EPSS Score
0.05%
Published
2024-01-12
Updated
2024-01-19
Improper neutralization of active check command arguments in Checkmk < 2.1.0p32, < 2.0.0p38, < 2.2.0p4 leads to arbitrary command execution for authenticated users.
Max CVSS
8.8
EPSS Score
0.05%
Published
2023-08-10
Updated
2023-08-17
Improper neutralization of livestatus command delimiters in the RestAPI in Checkmk < 2.0.0p36, < 2.1.0p28, and < 2.2.0b8 (beta) allows arbitrary livestatus command execution for authorized users.
Max CVSS
8.8
EPSS Score
0.08%
Published
2023-05-17
Updated
2023-05-26
Transmission of credentials within query parameters in Checkmk <= 2.1.0p26, <= 2.0.0p35, and <= 2.2.0b6 (beta) may cause the automation user's secret to be written to the site Apache access log.
Max CVSS
5.5
EPSS Score
0.04%
Published
2023-05-02
Updated
2023-05-09
Improper Input Validation in Checkmk <2.2.0p15, <2.1.0p37, <=2.0.0p39 allows priviledged attackers to cause partial denial of service of the UI via too long hostnames.
Max CVSS
2.7
EPSS Score
0.04%
Published
2023-11-15
Updated
2023-11-21
Reflected XSS in business intelligence in Checkmk <2.2.0p8, <2.1.0p32, <2.0.0p38, <=1.6.0p30.
Max CVSS
6.1
EPSS Score
0.05%
Published
2023-08-01
Updated
2023-08-04
Improper Authorization in RestAPI in Checkmk GmbH's Checkmk versions <2.1.0p28 and <2.2.0b8 allows remote authenticated users to read arbitrary host_configs.
Max CVSS
4.3
EPSS Score
0.06%
Published
2023-05-17
Updated
2023-05-25
HTML Email Injection in Tribe29 Checkmk <=2.1.0p23; <=2.0.0p34, and all versions of Checkmk 1.6.0 allows an authenticated attacker to inject malicious HTML into Emails
Max CVSS
5.4
EPSS Score
0.05%
Published
2023-03-20
Updated
2023-03-23
Privilege escalation in jar_signature agent plugin in Checkmk before 2.2.0p18, 2.1.0p38 and 2.0.0p39 allows local user to escalate privileges
Max CVSS
8.8
EPSS Score
0.04%
Published
2024-01-12
Updated
2024-01-19
Privilege escalation in mk_tsm agent plugin in Checkmk before 2.2.0p18, 2.1.0p38 and 2.0.0p39 allows local user to escalate privileges
Max CVSS
8.8
EPSS Score
0.04%
Published
2024-01-12
Updated
2024-01-19
Cross-site Request Forgery (CSRF) in Checkmk < 2.2.0p15, < 2.1.0p37, <= 2.0.0p39 allow an authenticated attacker to delete user-messages for individual users.
Max CVSS
3.5
EPSS Score
0.05%
Published
2023-11-24
Updated
2023-11-30
Improper neutralization of livestatus command delimiters in ajax_search in Checkmk <= 2.0.0p39, < 2.1.0p37, and < 2.2.0p15 allows arbitrary livestatus command execution for authorized users.
Max CVSS
8.8
EPSS Score
0.05%
Published
2023-11-22
Updated
2023-11-30
Improper neutralization of livestatus command delimiters in the availability timeline in Checkmk <= 2.0.0p39, < 2.1.0p37, and < 2.2.0p15 allows arbitrary livestatus command execution for authorized users.
Max CVSS
8.8
EPSS Score
0.05%
Published
2023-11-22
Updated
2023-11-30
Insufficient permission checks in the REST API in Tribe29 Checkmk <= 2.1.0p27 and <= 2.2.0b4 (beta) allow unauthorized users to schedule downtimes for any host.
Max CVSS
4.3
EPSS Score
0.05%
Published
2023-04-18
Updated
2023-04-27
Inappropriate error handling in Tribe29 Checkmk <= 2.1.0p25, <= 2.0.0p34, <= 2.2.0b3 (beta), and all versions of Checkmk 1.6.0 causes the symmetric encryption of agent data to fail silently and transmit the data in plaintext in certain configurations.
Max CVSS
5.3
EPSS Score
0.05%
Published
2023-04-04
Updated
2023-04-11
Improper Input Validation of LDAP user IDs in Tribe29 Checkmk allows attackers that can control LDAP user IDs to manipulate files on the server. Checkmk <= 2.1.0p19, Checkmk <= 2.0.0p32, and all versions of Checkmk 1.6.0 (EOL) are affected.
Max CVSS
8.1
EPSS Score
0.07%
Published
2023-01-26
Updated
2023-02-06
Limited Server-Side Request Forgery (SSRF) in agent-receiver in Tribe29's Checkmk <= 2.1.0p11 allows an attacker to communicate with local network restricted endpoints by use of the host registration API.
Max CVSS
6.8
EPSS Score
0.04%
Published
2023-02-20
Updated
2024-01-09
Cross-site Request Forgery (CSRF) in Tribe29's Checkmk <= 2.1.0p17, Checkmk <= 2.0.0p31, and all versions of Checkmk 1.6.0 (EOL) allow an attacker to add new visual elements to multiple pages.
Max CVSS
5.4
EPSS Score
0.05%
Published
2023-02-20
Updated
2023-03-02
Sensitive host secret disclosed in cmk-update-agent.log file in Tribe29's Checkmk <= 2.1.0p13, Checkmk <= 2.0.0p29, and all versions of Checkmk 1.6.0 (EOL) allows an attacker to gain access to the host secret through the unprotected agent updater log file.
Max CVSS
6.5
EPSS Score
0.04%
Published
2023-02-20
Updated
2023-03-03
No authorisation controls in the RestAPI documentation for Tribe29's Checkmk <= 2.1.0p13 and Checkmk <= 2.0.0p29 which may lead to unintended information disclosure through automatically generated user specific tags within Rest API documentation.
Max CVSS
5.3
EPSS Score
0.05%
Published
2023-02-20
Updated
2023-03-06
Expired sessions were not securely terminated in the RestAPI for Tribe29's Checkmk <= 2.1.0p10 and Checkmk <= 2.0.0p28 allowing an attacker to use expired session tokens when communicating with the RestAPI.
Max CVSS
9.8
EPSS Score
0.17%
Published
2023-02-20
Updated
2023-03-06
Livestatus Query Language (LQL) injection in the AuthUser HTTP query header of Tribe29's Checkmk <= 2.1.0p11, Checkmk <= 2.0.0p28, and all versions of Checkmk 1.6.0 (EOL) allows an attacker to perform direct queries to the application's core from localhost.
Max CVSS
7.8
EPSS Score
0.04%
Published
2023-02-20
Updated
2023-12-21
32 vulnerabilities found
1 2
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!